Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/fastrepl/anarlog/qa-cli-mcp-apinpx skills add fastrepl/anarlog --skill qa-cli-mcp-apigit clone --depth 1 https://github.com/fastrepl/anarlogWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00047 | $0.02820 |
| Opus 5 | $0.00023 | $0.01410 |
| Sonnet 5 | $0.00009 | $0.00564 |
| Haiku 4.5 | $0.00005 | $0.00282 |
Grade A, and why
qa-cli-mcp-api scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 281 lines — stays where its author put it; the contents beside it link to each section on GitHub.
QA: CLI, MCP, and API
Default to the smallest set of programmatic-interface lanes that can prove the change. Automated tests are necessary but do not replace a live smoke test when the changed boundary is only exercised by a real client or deployment.
This QA workflow is independent from releasing. A release request alone does not invoke it, and its results do not approve or block a release.
Choose the scope first
Inspect the exact branch, commit, or diff and map changed code to its direct
consumers before creating fixtures or credentials. In a GitButler workspace,
use but status and but show <commit-or-branch>; do not use the synthetic
workspace HEAD as the candidate or combine unrelated applied branches.
Find the original reproduction in the current or past Codex task, linked issue, PR, support report, or regression test. State the selected lanes and the reason for each before testing.
Targeted regression mode (default)
Select lanes by behavior, not by the existence of this checklist:
- CLI parsing, output, or local DB access → CLI plus the closest contract tests.
- Webhook endpoints, signing, or delivery retries → the webhook cases only.
- Shared agent-access DTOs, exports, filtering, or pagination → every direct consumer, including hosted REST or remote MCP when affected, plus cross-surface parity only for the changed fields.
- Hosted auth, snapshots, entitlements, isolation, purge, or Supabase policy → the affected hosted REST lifecycle and negative cases.
- Local or remote MCP protocol/tool changes → that MCP lane and its direct transport/contract dependency.
- Shared hosted REST/MCP behavior → both hosted consumers, but not unrelated local surfaces.
Run the closest affected automated tests, the original live reproduction, and
only credible boundary cases. A Rust or shared-crate change does not trigger
all lanes unless every lane consumes the changed behavior. Create only the
minimum non-sensitive fixture required for the selected checks. If a required
deployment, account, fixture, or client is unavailable, mark that check
BLOCKED; do not substitute unrelated lanes. Stop when the mapped risks are
covered.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 281 lines · 47 tokens per session scan A 04f5612d71e4
qa-cli-mcp-api is a skill published in the GitHub repository fastrepl/anarlog (9,219 stars, last pushed today), licensed MIT. It adds 47 tokens to every session and 2,820 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
shellx-host
ShellX host-session manifest. Use only when the current prompt or runtime metadata positively identifies this session as running inside ShellX, when ShellX host tools are advertised, or when the user explicitly asks about ShellX host APIs or surfaces. Do not use merely because this skill is installed, a project…
design-language
Use when building, modifying, or fixing any frontend UI in the Asyar launcher — new components, new views, layout changes, styling decisions, new built-in features, visual bug fixes, and anything in settings or onboarding. Answers "what do I use here?" for fonts, colour, typography, spacing, motion, components, and…
architectural-integrity
Use before planning or implementing ANY feature, bug fix, refactor, or API change that touches Asyar's architecture — extension system, service layer, IPC contracts, Tauri commands, manifest contributions, or cross-layer data flow. Triggers on new features, new extension APIs, new services, bug fixes involving…
generated-files
Never hand-edit or hand-copy generated content. Use when touching permissions.rs, error.rs, AppError/SearchError variants, runtimes/catalog.fallback.json, any #[derive(specta::Type)] struct, any file with an AUTO-GENERATED banner (kinds.ts, gatedPermissions.ts, knownRuntimes.ts, bindings.ts, emoji data), or whenever…
dev-environment
Reference for the Asyar monorepo structure, SDK workspace linking, lockfile discipline, CI workflows, and release flow. Use this skill whenever working on anything related to pnpm workspace setup, the asyar-sdk dependency, lockfile errors, SDK or launcher version bumps, CI configuration, release workflow, or questions…
review-ipc
Audit IPC message contracts between extensions and the Asyar host. Use when adding a new SDK service, adding a new proxy method, changing a postMessage type string, or reviewing permission gate coverage.